Merge pull request #79 from magweter/dev #233
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push Docker Image | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - dev | |
| tags: | |
| - 'v*' | |
| paths: | |
| - 'backend/**' | |
| - '.github/workflows/docker-build.yml' | |
| workflow_dispatch: | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build-and-push: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| with: | |
| driver: docker-container | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| # latest and stable only on version tags — never on raw branch commits | |
| type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }} | |
| type=raw,value=stable,enable=${{ startsWith(github.ref, 'refs/tags/v') }} | |
| # For dev branch | |
| type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }} | |
| # For version tags: v1.7.0 → image tags 1.7.0 and 1.7 | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| # Common tags | |
| type=ref,event=branch | |
| type=sha,format=short | |
| - name: Determine version | |
| id: version | |
| # Ref values are passed through env rather than interpolated into the script: | |
| # a `${{ }}` expression inside `run:` is substituted before the shell sees it, so a | |
| # crafted ref name would be executed as shell. Flagged by Semgrep as | |
| # github-actions.security.run-shell-injection. | |
| env: | |
| REF_TYPE: ${{ github.ref_type }} | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| if [[ "$REF_TYPE" == "tag" ]]; then | |
| # Strip leading 'v' so the app displays "1.7.0" not "v1.7.0" | |
| echo "git_tag=${REF_NAME#v}" >> "$GITHUB_OUTPUT" | |
| echo "git_commit=" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "git_tag=" >> "$GITHUB_OUTPUT" | |
| # Truncate to 7 chars (standard short SHA) | |
| echo "git_commit=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: ./backend | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| GIT_TAG=${{ steps.version.outputs.git_tag }} | |
| GIT_COMMIT=${{ steps.version.outputs.git_commit }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |